Security Bulletin: IBM Enterprise Build of Quarkus is affected by multiple vulnerabilities

Summary IBM Enterprise Build of Quarkus is affected by vulnerabilities in Quarkus REST Data Panache, Quarkus Qute, Jackson Core, Jackson Data Binding, RESTEasy, yawkat LZ4 Java, Micrometer Core, MariaDB Connector/J, MongoDB Java Driver, Neethi Vulnerability Details CVEID:CVE-2026-19032 DESCRIPTIO...

SugarCRM - Unauthenticated Remote Code Execution via PHP Object Injection

A PHP object injection vulnerability exists in SugarCRM versions prior to 6.5.24, 6.7.13, 7.5.2.5, 7.6.2.2, and 7.7.1.0 due to improper validation of PHP serialized input in the SugarRestSerialize.php script. The vulnerable code fails to sanitize the restdata parameter before passing it to the...

CVE-2026-87744

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-87744 Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-87744 Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

EUVD-2026-97766

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-87744

A security flaw in Quarkus REST Data Panache allows unauthenticated attackers to bypass security controls on generated endpoints. The vulnerability occurs when a developer customizes an operation using @MethodProperties without explicitly re-declaring security roles; the code generator silently d...

CVE-2026-87744

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

CVE-2026-94451

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-94451

The Quarkus REST Data Panache component is vulnerable to information disclosure and denial of service (DoS) due to an unvalidated sort parameter . An attacker can exploit this flaw on certain endpoints to gain unauthorized access to information or force the database to perform complex tasks, pote...

CVE-2026-94451 Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-94451 Quarkus-hibernate-orm-rest-data-panache: quarkus-hibernate-orm-rest-data-panache: information disclosure and dos via unvalidated sort parameter in rest data panache

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

EUVD-2026-97678

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-94451

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

PT-2026-110887

Name of the Vulnerable Software and Affected Versions Quarkus REST Data Panache versions 3.27 through 3.33 Description A flaw in the hibernate-orm-rest-data-panache extension allows unauthenticated attackers to bypass security controls on generated endpoints. This occurs when a developer customiz...

CVE-2026-87744: Direct Request

A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silent...

PT-2026-110814

Name of the Vulnerable Software and Affected Versions Quarkus REST Data Panache affected versions not specified Description Quarkus REST Data Panache automatically generates REST endpoints for data entities. A flaw exists where certain endpoints fail to properly validate the sort parameter provid...

CVE-2026-94451: Improper Input Validation

Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down t...

CVE-2026-67311 Budibase before 3.38.1 SSRF Blacklist Bypass via HTTP Redirect

Budibase before 3.38.1 contains a server-side request forgery vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to...

Information Exposure

Overview @budibase/types is a Budibase types Affected versions of this package are vulnerable to Information Exposure via the rest integration process. An attacker can obtain sensitive authentication credentials by supplying a crafted absolute URL as a query parameter, causing the system to forwa...